/*
 * Utility.h
 *
 *  Created on: 2013-10-16
 *      Author: WinDDK
 */
#ifndef UTILITY_H_
#define UTILITY_H_
#ifdef __cplusplus
extern "C"
{
#endif
#include <ntddk.h>
#include <ntimage.h>
#include <windef.h>

#define SystemBasicInformation 0
#define SystemProcessInformation 5
#define SystemModuleInformation 11

#define UTILITYTAG 'UTIL'
#define KIPETAG  'KIPE'
#define KIKERNEL 'KIKL'
#define KIWIN32K 'KIWK'

#define try _try
#define except _except

typedef struct _SYSTEM_SERVICE_TABLE
{
    PULONG ServiceTable;
    PULONG ServiceCounterTable;
    ULONG NumberOfService;
    PUCHAR ParamTable;
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE;

typedef struct _SYSTEM_HANDLE_INFORMATION
{
    ULONG ProcessId;
    UCHAR ObjectTypeNumber;
    UCHAR Flags;
    USHORT Handle;
    PVOID Object;
    ACCESS_MASK GrantedAccess;
} _SYSTEM_HANDLE_INFORMATION, *P_SYSTEM_HANDLE_INFORMATION;

typedef struct _SYSTEM_HANDLE_INformATION_EX
{
    ULONG NumberOfHandles;
    _SYSTEM_HANDLE_INFORMATION Information[1];
} _SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;

typedef struct _SYSTEM_MODULE_INFORMATION
{
    ULONG Reserved[2];
    PVOID ImageBase;
    ULONG ImageSize;
    ULONG Flags;
    USHORT Index;
    USHORT Unknown;
    USHORT LoadCount;
    USHORT ModuleNameOffset;
    CHAR ImageName[256];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef struct _SYSTEM_MODULES
{
    ULONG NumberOfModules;
    SYSTEM_MODULE_INFORMATION Modules[1];
} SYSTEM_MODULES, *PSYSTEM_MODULES;

typedef struct _SYSTEM_THREAD_INFORMATION
{
    LARGE_INTEGER KernelTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER CreateTime;
    ULONG WaitTime;
    PVOID StartAddress;
    CLIENT_ID ClientId;
    KPRIORITY Priority;
    KPRIORITY BasePriority;
    ULONG ContextSwitchCount;
    LONG State;
    LONG WaitReason;
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;

typedef struct _SYSTEM_PROCESS_INFORMATION
{
    ULONG NextEntryDelta;
    ULONG ThreadCount;
    ULONG Reserved1[6];
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER KernelTime;
    UNICODE_STRING ProcessName;
    KPRIORITY BasePriority;
    ULONG ProcessId;
    ULONG InheritedFromProcessId;
    ULONG HandleCount;
    ULONG Reserved2[2];
    VM_COUNTERS VmCounters;
    IO_COUNTERS IoCounters;
    SYSTEM_THREAD_INFORMATION Threads[1];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

typedef struct _SYSTEM_BASIC_INFORMATION
{
    ULONG Unknown;
    ULONG MaximumIncrement;
    ULONG PhysicalPageSize;
    ULONG NumberOfPhysicalPages;
    ULONG LowestPhysicalPage;
    ULONG HighestPhysicalPage;
    ULONG AllocationGranularity;
    ULONG LowestUserAddress;
    ULONG HighestUserAddress;
    ULONG ActiveProcessors;
    UCHAR NumberProcessors;
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;

typedef struct _EX_PUSH_LOCK
{
    union
    {
        struct
        {
            ULONG Waiting :1;
            ULONG Exclusive :1;
            ULONG Shared :30;
        };
        ULONG Value;
        PVOID Ptr;
    };

} EX_PUSH_LOCK, *PEX_PUSH_LOCK;

typedef struct _HANDLE_TRACE_DB_ENTRY
{
    CLIENT_ID ClientId;
    HANDLE Handle;
    ULONG Type;
    PVOID StackTrace[16];
} HANDLE_TRACE_DB_ENTRY, *PHANDLE_TRACE_DB_ENTRY;

typedef struct _HANDLE_TRACE_DEBUG_INFO
{
    ULONG CurrentStackIndex;
    HANDLE_TRACE_DB_ENTRY TraceDb[4096];

} HANDLE_TRACE_DEBUG_INFO, *PHANDLE_TRACE_DEBUG_INFO;

typedef struct _HANDLE_TABLE
{
    PVOID TableCode;
    PEPROCESS QuotaProcess;
    PVOID UniqueProcessId;
    EX_PUSH_LOCK HandleTableLock[4];
    LIST_ENTRY HandleTableList;
    EX_PUSH_LOCK HandleContentionEvent;
    PHANDLE_TRACE_DEBUG_INFO DebugInfo;
    ULONG ExtraInfoPages;
    ULONG FirstFree;
    ULONG LastFree;
    ULONG NextHandleNeedingPool;
    ULONG HandleCount;
    ULONG Flags;
} HANDLE_TABLE, *PHANDLE_TABLE;

typedef struct _HANDLE_TABLE_ENTRY
{
    union
    {
        PVOID Object;
        ULONG ObAttributes;
    };
    union
    {
        union
        {
            ACCESS_MASK GrantedAccess;
            struct
            {
                USHORT GrantedAccessIndex;
                USHORT CreatorBackTraceIndex;
            };
        };
        LONG NextFreeTableEntry;
    };
} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;

#pragma pack(1)
typedef struct
{
    unsigned short LowOffset;
    unsigned short selector;
    unsigned char unused_lo;
    unsigned char segment_type :4;   //0x0E is an interrupt gate
    unsigned char system_segment_flag :1;
    unsigned char DPL :2;          // descriptor privilege level
    unsigned char P :1; /* present */
    unsigned short HiOffset;
} IDTENTRY;

typedef struct
{
    unsigned short IDTLimit;
    unsigned short LowIDTbase;
    unsigned short HiIDTbase;
} IDTINFO;
#pragma pack()

typedef struct _KEXECUTE_OPTIONS
{
    UCHAR ExecuteDisable :1;
    UCHAR ExecuteEnable :1;
    UCHAR DisableThunkEmulation :1;
    UCHAR Permanent :1;
    UCHAR ExecuteDispatchEnable :1;
    UCHAR ImageDispatchEnable :1;
    UCHAR Spare :2;
} KEXECUTE_OPTIONS, PKEXECUTE_OPTIONS;

typedef struct _KPROCESS
{
    struct _DISPATCHER_HEADER Header;
    struct _LIST_ENTRY ProfileListHead;
    ULONG32 DirectoryTableBase[2];
    struct _LIST_ENTRY LdtDescriptor;
    struct _LIST_ENTRY Int21Descriptor;
    UINT16 IopmOffset;
    UINT8 Iopl;
    UINT8 Unused;
    ULONG32 ActiveProcessors;
    ULONG32 KernelTime;
    ULONG32 UserTime;
    struct _LIST_ENTRY ReadyListHead;
    struct _SINGLE_LIST_ENTRY SwapListEntry;VOID* VdmTrapcHandler;
    struct _LIST_ENTRY ThreadListHead;
    ULONG32 ProcessLock;
    ULONG32 Affinity;
    UINT16 StackCount;
    CHAR BasePriority;
    CHAR ThreadQuantum;
    UINT8 AutoAlignment;
    UINT8 State;
    UINT8 ThreadSeed;
    UINT8 DisableBoost;
    UINT8 PowerState;
    UINT8 DisableQuantum;
    UINT8 IdealNode;
    union
    {
        struct _KEXECUTE_OPTIONS Flags;
        UINT8 ExecuteOptions;
    };
} KPROCESS, *PKPROCESS;

typedef struct _EPROCESS
{
    KPROCESS Pcb;
    EX_PUSH_LOCK ProcessLock;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER ExitTime;
    EX_RUNDOWN_REF RundownProtect;
    HANDLE UniqueProcessId;
    LIST_ENTRY ActiveProcessLinks;
    ULONG QuotaUsage[3];
    ULONG QuotaPeak[3];
    ULONG CommitCharge;
    ULONG PeakVirtualSize;
    ULONG VirtualSize;
    LIST_ENTRY SessionProcessLinks;
    PVOID DebugPort;
    PVOID ExceptionPort;
    PVOID ObjectTable;
    PVOID Token;
    FAST_MUTEX WorkingSetLock;
    ULONG WorkingSetPage;
    KGUARDED_MUTEX AddressCreationLock;
    KSPIN_LOCK HyperSpaceLock;
    PETHREAD ForkInProgress;
    ULONG HardwareTrigger;
    PVOID VadRoot;
    PVOID VadHint;
    PVOID CloneRoot;
    ULONG NumberOfPrivatePages;
    ULONG NumberOfLockedPages;
    PVOID *Win32Process;
    struct _EJOB *Job;
    PVOID SectionObject;
    PVOID SectionBaseAddress;
    PVOID QuotaBlock;
    PVOID WorkingSetWatch;
    PVOID Win32WindowStation;
    HANDLE InheritedFromUniqueProcessId;
    PVOID LdtInformation;
    PVOID VadFreeHint;
    PVOID VdmObjects;
    PVOID DeviceMap;
    LIST_ENTRY PhysicalVadList;
    union
    {
        UCHAR PageDirectoryPte[8];
        ULONGLONG Filler;
    };
    ULONG Session;
    CHAR ImageFileName[16];
    LIST_ENTRY JobLinks;
    PVOID LockedPagesList;
    LIST_ENTRY ThreadListHead;
    PVOID SecurityPort;
    PVOID PaeTop;
    ULONG ActiveThreads;
    ACCESS_MASK GrantedAccess;
    ULONG DefaultHardErrorProcessing;
    NTSTATUS LastThreadExitStatus;
    PPEB Peb;
    UCHAR PrefetchTrace[4];
    LARGE_INTEGER ReadOperationCount;
    LARGE_INTEGER WriteOperationCount;
    LARGE_INTEGER OtherOperationCount;
    LARGE_INTEGER ReadTransferCount;
    LARGE_INTEGER WriteTransferCount;
    LARGE_INTEGER OtherTransferCount;
    ULONG CommitChargeLimit;
    ULONG CommitChargePeak;
    PVOID AweInfo;
    UCHAR SeAuditProcessCreationInfo[4];
    UCHAR Vm[64];
    ULONG LastFaultCount;
    ULONG ModifiedPageCount;
    ULONG NumberOfVads;
    ULONG JobStatus;
    union
    {
        ULONG Flags;
        struct
        {
            ULONG CreateReported :1;
            ULONG NoDebugInherit :1;
            ULONG ProcessExiting :1;
            ULONG ProcessDelete :1;
            ULONG Wow64SplitPages :1;
            ULONG VmDeleted :1;
            ULONG OutswapEnabled :1;
            ULONG Outswapped :1;
            ULONG ForkFailed :1;
            ULONG HasPhysicalVad :1;
            ULONG AddressSpaceInitialized :2;
            ULONG SetTimerResolution :1;
            ULONG BreakOnTermination :1;
            ULONG SessionCreationUnderway :1;
            ULONG WriteWatch :1;
            ULONG ProcessInSession :1;
            ULONG OverrideAddressSpace :1;
            ULONG HasAddressSpace :1;
            ULONG LaunchPrefetched :1;
            ULONG InjectInpageErrors :1;
            ULONG VmTopDown :1;
            ULONG ImageNotifyDone :1;
            ULONG PdeUpdateNeeded :1;
            ULONG VdmAllowed :1;
            ULONG SmapAllowed :1;
            ULONG CreateFailed :1;
            ULONG DefaultIoPriority :3;
            ULONG Spare1 :1;
            ULONG Spare2 :1;
        };
    };
    NTSTATUS ExitStatus;
    USHORT NextPageColor;
    union
    {
        struct
        {
            UCHAR SubSystemMinorVersion;
            UCHAR SubSystemMajorVersion;
        };
        USHORT SubSystemVersion;
    };
    UCHAR PriorityClass;
    UCHAR WorkingSetAcquiredUnsafe;
    ULONG Cookie;
} EPROCESS, *PEPROCESS;

typedef struct _KAPC_STATE
{
    LIST_ENTRY ApcListHead[MaximumMode];
    struct _KPROCESS *Process;
    BOOLEAN KernelApcInProgress;
    BOOLEAN KernelApcPending;
    BOOLEAN UserApcPending;
} KAPC_STATE, *PKAPC_STATE, *PRKAPC_STATE;

typedef struct _KQUEUE
{
    DISPATCHER_HEADER Header;
    LIST_ENTRY EntryListHead;       // Object lock
    volatile ULONG CurrentCount;    // Interlocked
    ULONG MaximumCount;
    LIST_ENTRY ThreadListHead;      // Object lock
} KQUEUE, *PKQUEUE, *PRKQUEUE;

typedef struct _KTHREAD
{
    DISPATCHER_HEADER Header;
    LIST_ENTRY MutantListHead;
    PVOID InitialStack;
    PVOID StackLimit;
    PVOID Teb;
    PVOID TlsArray;
    PVOID KernelStack;
    UCHAR DebugActive;
    UCHAR State;
    UCHAR Alerted[2];
    UCHAR Iopl;
    UCHAR NpxState;
    CHAR Saturation;
    CHAR Priority;
    KAPC_STATE ApcState;
    UINT32 ContextSwitches;
    UCHAR IdleSwapBlock;
    UCHAR Spare0[3];
    INT32 WaitStatus;
    UCHAR WaitIrql;
    CHAR WaitMode;
    UCHAR WaitNext;
    UCHAR WaitReason;
    PKWAIT_BLOCK WaitBlockList;
    union
    {
        LIST_ENTRY WaitListEntry;
        SINGLE_LIST_ENTRY SwapListEntry;
    };
    UINT32 WaitTime;
    CHAR BasePriority;
    UCHAR DecrementCount;
    CHAR PriorityDecrement;
    CHAR Quantum;
    KWAIT_BLOCK WaitBlock[4];
    PVOID LegoData;
    UINT32 KernelApcDisable;
    UINT32 UserAffinity;
    UCHAR SystemAffinityActive;
    UCHAR PowerState;
    UCHAR NpxIrql;
    UCHAR InitialNode;
    PVOID ServiceTable;
    PKQUEUE Queue;
    UINT32 ApcQueueLock;
    KTIMER Timer;
    LIST_ENTRY QueueListEntry;
    UINT32 SoftAffinity;
    UINT32 Affinity;
    UCHAR Preempted;
    UCHAR ProcessReadyQueue;
    UCHAR KernelStackResident;
    UCHAR NextProcessor;
    PVOID CallbackStack;
    PVOID Win32Thread;
    PVOID TrapFrame;
    PKAPC_STATE ApcStatePointer[2];
    CHAR PreviousMode;
    UCHAR EnableStackSwap;
    UCHAR LargeStack;
    UCHAR ResourceIndex;
    UINT32 KernelTime;
    UINT32 UserTime;
    KAPC_STATE SavedApcState;
    UCHAR Alertable;
    UCHAR ApcStateIndex;
    UCHAR ApcQueueable;
    UCHAR AutoAlignment;
    PVOID StackBase;
    KAPC SuspendApc;
    KSEMAPHORE SuspendSemaphore;
    LIST_ENTRY ThreadListEntry;
    CHAR FreezeCount;
    CHAR SuspendCount;
    UCHAR IdealProcessor;
    UCHAR DisableBoost;
} KTHREAD;

typedef struct _ETHREAD
{
    KTHREAD Tcb;
    LARGE_INTEGER CreateTime;
    union
    {
        LARGE_INTEGER ExitTime;
        LIST_ENTRY LpcReplyChain;
        LIST_ENTRY KeyedWaitChain;
    };
    union
    {
        NTSTATUS ExitStatus;
        PVOID OfsChain;
    };
    LIST_ENTRY PostBlockList;
    union
    {
        PVOID TerminationPort;
        struct _ETHREAD *ReaperLink;
        PVOID KeyedWaitValue;
    };
    KSPIN_LOCK ActiveTimerListLock;
    LIST_ENTRY ActiveTimerListHead;
    CLIENT_ID Cid;
    union
    {
        KSEMAPHORE LpcReplySemaphore;
        KSEMAPHORE KeyedWaitSemaphore;
    };
    union
    {
        PVOID LpcReplyMessage;
        PVOID LpcWaitingOnPort;
    };
    PVOID ImpersonationInfo;
    LIST_ENTRY IrpList;
    ULONG_PTR TopLevelIrp;
    struct _DEVICE_OBJECT *DeviceToVerify;
    PEPROCESS ThreadsProcess;
    PVOID StartAddress;
    union
    {
        PVOID Win32StartAddress;
        ULONG LpcReceivedMessageId;
    };
    LIST_ENTRY ThreadListEntry;
    EX_RUNDOWN_REF RundownProtect;
    ULONG ThreadLock;
    ULONG LpcReplyMessageId;
    ULONG ReadClusterSize;
    ACCESS_MASK GrantedAccess;
    union
    {
        ULONG CrossThreadFlags;
        struct
        {
            ULONG Terminated :1;
            ULONG DeadThread :1;
            ULONG HideFromDebugger :1;
            ULONG ActiveImpersonationInfo :1;
            ULONG SystemThread :1;
            ULONG HardErrorsAreDisabled :1;
            ULONG BreakOnTermination :1;
            ULONG SkipCreationMsg :1;
            ULONG SkipTerminationMsg :1;
        };
    };
    union
    {
        ULONG SameThreadPassiveFlags;
        struct
        {
            ULONG ActiveExWorker :1;
            ULONG ExWorkerCanWaitUser :1;
            ULONG MemoryMaker :1;
            ULONG KeyedEventInUse :1;
        };
    };
    union
    {
        ULONG SameThreadApcFlags;
        struct
        {
            BOOLEAN LpcReceivedMsgIdValid :1;
            BOOLEAN LpcExitThreadCalled :1;
            BOOLEAN AddressSpaceOwner :1;
            BOOLEAN OwnsProcessWorkingSetExclusive :1;
            BOOLEAN OwnsProcessWorkingSetShared :1;
            BOOLEAN OwnsSystemWorkingSetExclusive :1;
            BOOLEAN OwnsSystemWorkingSetShared :1;
            BOOLEAN OwnsSessionWorkingSetExclusive :1;
            BOOLEAN OwnsSessionWorkingSetShared :1;
            BOOLEAN ApcNeeded :1;
        };
    };
    BOOLEAN ForwardClusterOnly;
    BOOLEAN DisablePageFaultClustering;
    UCHAR ActiveFaultCount;
} ETHREAD, *PETHREAD;

typedef struct _OBJECT_TYPE_INITIALIZER
{
    USHORT Length;
    BOOLEAN UseDefaultObject;
    BOOLEAN CaseInsensitive;
    ULONG InvalidAttributes;
    GENERIC_MAPPING GenericMapping;
    ULONG ValidAccessMask;
    BOOLEAN SecurityRequired;
    BOOLEAN MaintainHandleCount;
    BOOLEAN MaintainTypeList;
    POOL_TYPE PoolType;
    ULONG DefaultPagedPoolCharge;
    ULONG DefaultNonPagedPoolCharge;
    PVOID DumpProcedure;
    PVOID OpenProcedure;
    PVOID CloseProcedure;
    PVOID DeleteProcedure;
    PVOID ParseProcedure;
    PVOID SecurityProcedure;
    PVOID QueryNameProcedure;
    PVOID OkayToCloseProcedure;
} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;

typedef struct _LDR_DATA_TABLE_ENTRY
{
    LIST_ENTRY InLoadOrderLinks;
    LIST_ENTRY InMemoryOrderLinks;
    LIST_ENTRY InInitializationOrderLinks;
    PVOID DllBase;
    PVOID EntryPoint;
    ULONG SizeOfImage;
    UNICODE_STRING FullDllName;
    UNICODE_STRING BaseDllName;
    ULONG Flags;
    USHORT LoadCount;
    USHORT TlsIndex;
    union
    {
        LIST_ENTRY HashLinks;
        struct
        {
            PVOID SectionPointer;
            ULONG CheckSum;
        };
    };
    union
    {
        struct
        {
            ULONG TimeDateStamp;
        };
        struct
        {
            PVOID LoadedImports;
        };
    };
    struct _ACTIVATION_CONTEXT * EntryPointActivationContext;
    PVOID PatchInformation;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

typedef struct _KTRAP_FRAME                               // 35 elements, 0x8C bytes (sizeof)
{
    ULONG32 DbgEbp;
    ULONG32 DbgEip;
    ULONG32 DbgArgMark;
    ULONG32 DbgArgPointer;
    ULONG32 TempSegCs;
    ULONG32 TempEsp;
    ULONG32 Dr0;
    ULONG32 Dr1;
    ULONG32 Dr2;
    ULONG32 Dr3;
    ULONG32 Dr6;
    ULONG32 Dr7;
    ULONG32 SegGs;
    ULONG32 SegEs;
    ULONG32 SegDs;
    ULONG32 Edx;
    ULONG32 Ecx;
    ULONG32 Eax;
    ULONG32 PreviousPreviousMode;
    struct _EXCEPTION_REGISTRATION_RECORD* ExceptionList;
    ULONG32 SegFs;
    ULONG32 Edi;
    ULONG32 Esi;
    ULONG32 Ebx;
    ULONG32 Ebp;
    ULONG32 ErrCode;
    ULONG32 Eip;
    ULONG32 SegCs;
    ULONG32 EFlags;
    ULONG32 HardwareEsp;
    ULONG32 HardwareSegSs;
    ULONG32 V86Es;
    ULONG32 V86Ds;
    ULONG32 V86Fs;
    ULONG32 V86Gs;
} KTRAP_FRAME, KEXCEPTION_FRAME, *PKTRAP_FRAME, *PKEXCEPTION_FRAME;

__declspec(dllimport)   VOID ExRaiseException(IN PEXCEPTION_RECORD ExceptionRecord);
__declspec(dllimport)   INT ExSystemExceptionFilter(VOID);

__declspec(dllimport)   NTSTATUS KeAddSystemServiceTable(IN PVOID ServiceTableBase, IN PVOID ServiceCounterTableBase, IN ULONG NumberOfService, IN PVOID ParamTableBase, IN ULONG InsertServiceTableIndex);
__declspec(dllimport)   NTSTATUS KeAttachProcess(PEPROCESS pPeb);
__declspec(dllimport)   NTSTATUS KeDetachProcess();

__declspec(dllimport)   NTSTATUS ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE PreviousMode);
__declspec(dllimport)   NTSTATUS ObCreateObject(IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL, IN POBJECT_TYPE ObjectType, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN PVOID Reserved, IN ULONG ObjectSizeToAllocate, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object);
__declspec(dllimport)   NTSTATUS ObCreateObjectType(IN PUNICODE_STRING TypeName, IN POBJECT_TYPE_INITIALIZER ObjectTypeInitializer, __in_opt PSECURITY_DESCRIPTOR SecurityDescriptor, __out POBJECT_TYPE *ObjectType);
__declspec(dllimport)   NTSTATUS ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, __in_opt POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, __inout_opt PACCESS_STATE AccessState, __in_opt ACCESS_MASK DesiredAccess, __inout_opt PVOID ParseContext, __out PHANDLE Handle);
__declspec(dllimport)   PUCHAR PsGetProcessImageFileName(IN PEPROCESS Process);
__declspec(dllimport)   NTSTATUS PsLookupProcessByProcessId(IN ULONG ulProcId, OUT PEPROCESS * pEProcess);

__declspec(dllimport)   NTSTATUS ZwCreateSection( OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL);
__declspec(dllimport)   NTSTATUS ZwDuplicateObject(IN HANDLE SourceProcessHandle, IN PHANDLE SourceHandle, IN HANDLE TargetProcessHandle, OUT PHANDLE TargetHandle, IN ACCESS_MASK DesiredAccess OPTIONAL, IN BOOLEAN InheritHandle, IN ULONG Options);
__declspec(dllimport)   NTSTATUS ZwOpenDirectoryObject( OUT PHANDLE DirectoryHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes);
__declspec(dllimport)   NTSTATUS ZwOpenProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId OPTIONAL);
__declspec(dllimport)   NTSTATUS ZwQueryInformationProcess(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength);
__declspec(dllimport)   NTSTATUS ZwQuerySystemInformation(IN ULONG SystemInformationClass, IN PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength);
__declspec(dllimport)   NTSTATUS ZwQueryObject(IN HANDLE ObjectHandle, IN ULONG ObjectInformationClass, OUT PVOID ObjectInformation, IN ULONG ObjectInformationLength, OUT PULONG ReturnLength OPTIONAL);
__declspec(dllimport)   NTSTATUS ZwYieldExecution(VOID);

__declspec(dllimport)   PIMAGE_NT_HEADERS RtlImageNtHeader(IN PVOID ModuleAddress);
__declspec(dllimport)   NTSTATUS ZwFlushInstructionCache(IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN ULONG NumberOfBytesToFlush);

extern PSYSTEM_SERVICE_TABLE KeServiceDescriptorTable;

#ifdef __cplusplus
}
#endif

#define KiDebug(msg, ...) DbgPrint("[%-25s:%3d]\t" msg "\n", __FUNCTION__, __LINE__, ##__VA_ARGS__)

void * __cdecl operator new(size_t size, POOL_TYPE type);

void * __cdecl operator new(size_t size, POOL_TYPE type, ULONG tag);

void __cdecl operator delete(void* ptr);

void __cdecl operator delete[](void * ptr);

void __cdecl PageProtectOff();

void __cdecl PageProtectOn();

ULONG __cdecl GetFunctionAddressByName(IN PCWSTR functionName);

#endif /* UTILITY_H_ */
